[ActiveDir] Audit Logs on DC

[Salandra, Justin A.]

Is it normal to see a person logging in and out over and over all day long every 90 minutes or so   I am getting a bunch of Event ID 540 and 538’s over and over for the same user every 90 minutes or so, is this just the Group Policy refreshing?  How can I pin point the actual user login and not just a refresh?   Justin A. Salandra MCSE Windows 2000 & 2003 Network and Technology Services Manager Catholic Healthcare System 646.505.3681 - office 917.455.0110 - cell [EMAIL PROTECTED]